The SAML IdP auth middleware should handle both the HTTP-Redirect binding and HTTP-POST binding requests.
Current behavior:
In an SP initiated SSO, if a user does not have an active authenticates session with Teleport, the IdP middleware redirects user to login URL with a redirect_uri that points to IdP SSO endpoint and a SAML authentication message: https://proxy/web/login?redirect_uri=https://proxy/enterprise/saml-idp/sso?SAMLRequest=<authN_message>&RelayState=<relay_state>.
The middleware however only considers for HTTP-Redirect binding request (HTTP GET) and appends value of URL query params to the redirect_uri. As such, when SP uses HTTP-POST binding, the SAML authentication message from the request body is ignored, which means the redirect_uri will be empty and the SSO breaks: https://proxy/web/login?redirect_uri=https://proxy/enterprise/saml-idp/sso<missing_SAMLRequest>
Bug details:
Teleport version: all current release of Teleport SAML IdP
Expected behavior:
The SAML IdP auth middleware should handle both the HTTP-Redirect binding and HTTP-POST binding requests.
Current behavior:
In an SP initiated SSO, if a user does not have an active authenticates session with Teleport, the IdP middleware redirects user to login URL with a
redirect_uri
that points to IdP SSO endpoint and a SAML authentication message:https://proxy/web/login?redirect_uri=https://proxy/enterprise/saml-idp/sso?SAMLRequest=<authN_message>&RelayState=<relay_state>
.The middleware however only considers for HTTP-Redirect binding request (HTTP GET) and appends value of URL query params to the
redirect_uri
. As such, when SP uses HTTP-POST binding, the SAML authentication message from the request body is ignored, which means theredirect_uri
will be empty and the SSO breaks:https://proxy/web/login?redirect_uri=https://proxy/enterprise/saml-idp/sso<missing_SAMLRequest>
Bug details: